ce0a32e35b7c79e7e2ffe7bd3c7566a6fb843341268ad50f4a594e56e17a5110

Resubmissions

11-07-2024 18:37

240711-w9z6ms1gmc 10

11-07-2024 08:47

240711-kp9zkayfjn 10

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 18:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NO-ESCAPE-main/No Escape.exe
Size

771KB
MD5

2782877418b44509fd306fd9afe43e39
SHA1

b0c18bdf782ca9c4fa41074f05458ce8e0f3961b
SHA256

56d612e014504c96bb92429c31eb93f40938015d422b35765912ac4e6bd3755b
SHA512

8826881b3ab406ee4c1fabd4848161f8524aeaeb7c4397384d36840f947ef95c8560850b2409fbf761ff225cdc8ac6eb875b705476fe9574b23c7a5478505a86
SSDEEP

24576:OeTrmlZGPL7NV9+VitFsQUxY8BGOdQSqZ:hT6KDrmIFsBJBG4XqZ

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 12 IoCs

Processes:

No Escape.exe

description	ioc	process
File created	C:\Program Files (x86)\hello.bat	No Escape.exe
File created	C:\Program Files (x86)\launch.exe	No Escape.exe
File created	C:\Program Files (x86)\msg.exe	No Escape.exe
File created	C:\Program Files (x86)\date.txt	No Escape.exe
File created	C:\Program Files (x86)\	No Escape.exe
File opened for modification	C:\Program Files (x86)\	No Escape.exe
File created	C:\Program Files (x86)\erode.exe	No Escape.exe
File created	C:\Program Files (x86)\hello.jpg	No Escape.exe
File created	C:\Program Files (x86)\hello.reg	No Escape.exe
File created	C:\Program Files (x86)\mover.exe	No Escape.exe
File created	C:\Program Files (x86)\mypc.exe	No Escape.exe
File created	C:\Program Files (x86)\shaking.exe	No Escape.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

No Escape.exe

description	pid	process	target process
PID 2596 wrote to memory of 2924	2596	No Escape.exe	wscript.exe
PID 2596 wrote to memory of 2924	2596	No Escape.exe	wscript.exe
PID 2596 wrote to memory of 2924	2596	No Escape.exe	wscript.exe
PID 2596 wrote to memory of 2924	2596	No Escape.exe	wscript.exe

C:\Users\Admin\AppData\Local\Temp\NO-ESCAPE-main\No Escape.exe
"C:\Users\Admin\AppData\Local\Temp\NO-ESCAPE-main\No Escape.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2596

C:\Windows\system32\wscript.exe
"C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\8334.tmp\8335.tmp\8336.vbs //Nologo
2⤵
PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8334.tmp\8335.tmp\8336.vbs

Filesize
588B

MD5
67706bca9ceaba11530e05d351487003

SHA1
3a5ed77f81b14093a5f18c4d46895bc7ea770fee

SHA256
190a0d994512ed000cf74bd40fb0502988c2ac48855b23a73fd905c0305fc30f

SHA512
902ac91678d85801a779acbc212c75beba72f8da996b0ed1b148a326c2dd635b88210f9a503fbbffa5271335483eae972e6a00acbc01ec013cf355c080444598

Download Submit